---
typeId: req
recordId: benac-enc-004
fields:
  title: Envelope encryption
  statement: Benac shall use envelope encryption for private blobs and private
    documents, with per-object content-encryption keys and recipient-specific
    key wrapping.
  rationale: Recipient-based sharing should not require re-encrypting entire
    objects and should avoid exposing long-term private keys.
  verification: Multiple recipient fixture decrypts with authorized recipient key
    and fails for non-recipient.
  testable: true
  status: draft
  area: BENAC-ENC
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.6 Encryption, decryption, and disclosure control
  order: 58
---
